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Abstract ICHM is the engine subsystem that 

controls the engine and monitors the 


NASA Lewis Research Center contracted 

# Aerojet and Rocketdyne to assess the 
Integrated Controls and Health Monitor- 
ing (ICHM) technologies that would 

, enable hydrogen- oxygen rocket engines 

to be space-based, reusable, and 
descent- throttleable . The results of 
these assessments are synthesized to 
determine the minimum required ICHM 
functions and system elements, and to 
estimate the technology readiness and 
system cost. The minimum functions 
include preflight checks, tank head 
start, closed-loop thrust and mixture 
ratio control with red- line/shutdown 
safety monitoring, sensor validation/ 
fault accommodation, and condition 
assessment. With the exception of the 
engine - dependent software and some of 
the advanced sensors , all the required 
elements have reached at least the 
technology readiness level of a lab- 
oratory demonstration. The total ICHM 
system readiness is at the level of a 
conceptual design. The estimated cost 
to provide a minimum ICHM system ready 
for demonstration on an engine system 
testbed is estimated to be $30 to $45 
million over six years. 

Introduction 

One way to substantially reduce 
operating costs for rocket engines is 

* to eliminate or subs tantially reduce 
maintenance inspections. This can be 
accomplished by integrating an instru- 
mentation and processing system into 
the engine controller which can measure 
and assess the engine's health before, 
during, and after engine firing. Such 
an Integrated Control and Health 
Monitoring (ICHM) system could also 
improve the engine's reliability by 
early detection and response to engine 
degradations and failures. 
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engine's health. It must provide 
stable and responsive control over the 
full throttling range, prevent cata- 
strophic engine failure, and reduce or 
eliminate the need for inspection and 
maintenance . 

A first step toward realizing these 
features is to select a representative 
set of mission requirements and then 
assess the technology necessary to 
satisfy these requirements. Using the 
Space Exploration Initiative (SEI) 
missions as this representative set, 
this paper answers the following 
questions about ICHM technology: 

(1) What are the minimum ICHM functions 
and technology elements necessary to 
satisfy the mission requirements, 

(2) is it feasible to satisfy the re- 
quirements with the currently projected 
ICHM technologies, and (3) how much 
will it cost to advance these ICHM 
technologies to the point were they can 
be confidently incorporated into the 
development of next space engine? 

To answer these questions, this 
paper summarizes and synthesizes the 
results of two different contractor 
assessments of ICHM technology (ref. 1 
& 2) . The synthesis involves combining 
their results into a single description 
and using the differences to reflect 
the uncertainty of the conclusions. 

Contractor Assessment Goals 

The contractors, Aerojet Propulsion 
Division of GenCorp, Sacramento, 
California, and the Rocketdyne Division 
of Rockwell International Corporation, 
Canoga Park, California, were each 
tasked by NASA Lewis Research Center to 
(1) specify the minimum functions of an 
ICHM system capable of meeting a given 
set of mission requirements, (2) ident- 
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ify the necessary system elements to 
provide those functions, (3) estimate 
the current technology readiness of 
each element, and (4) estimate the cost 
to advance the technology to the level 
where it is ready for a system demon- 
stration on an engine system testbed. 

A demonstration on an engine system 
testbed is considered sufficient tech- 
nological advancement to confidently 
proceed with the development of a pro- 
totype engine incorporating ICHM. Each 
contractor was asked to use their own 
Orbit Transfer Vehicle engine designs 
as the referenced engine technology. 

Mission Requirement Assumptions 

The most applicable mission scenar- 
ios that cover the general goal of 
improving operational efficiency and 
reliability, plus addressing the issues 
of in- space engine operations and oper- 
ational flexibility, are the SEI 
missions. The advanced space chemical 
engines for the SEI missions are re- 
quired to be human-rated, space-based, 
reusable without major service, and 
throttleable for descent maneuvers. 

The specific mission requirements 
assumed for this study are based on 
various studies by the NASA Office of 
Exploration which describe missions and 
vehicles for supporting a lunar base. 
The aspects of these study results that 
drive ICHM requirements (discussed in 
ref. 3) were provided to each con- 
tractor and are outlined below. 

Basic Engine Operation The 
propulsion system, consisting of 4 
engines, is required to be human-rated 
and fail -operational/fail -safe . This 
means that the propulsion system must 
still operate in the event of one 
failed engine (fail-op) and present no 
catastrophic hazards to the vehicle in 
the event of a second failed engine 
(fail-safe) . This translates to using 
a shutdown response to a failure within 
an engine, and having the capacity for 
engine-out operation of the propulsion 
system. The single-engine reliability 
is quantified as having a 0.9975 
probability of completing the mission. 

Because these engines will be used 


for space transfer, they must be 
capable of starting in zero gravity. 

This is accomplished by assuming the 
use of a tank head start for the 
engines . 

Reusability Reusability means 
sustaining reliability without major 
service. This is quantified as having 
a service-free life of 100 starts with 
4 hours total firing duration. This is 
based on a 5 mission life times a 
factor of 4 as a safety margin. 

Space-Basing The space-basing 
assumptions are that there would be no 
in-space facilities to routinely in- 
spect the engine, and that the entire 
engine would be the in- space replace- 
able unit. 

Descent Throttling A 10:1 throt- 
tling range (from 100% to 10% thrust) 
is assumed. No guidelines were avail- 
able for specifying the throttling 
response- time requirements for the 
engines . 

Product Evolution Since the mission 
studies assumed that one engine would 
be used for the variety of vehicles, a 
certain degree of flexibility for 
product improvement is required to be 
designed into the engine. 

Referenced Engine Technology 

The baseline engine from the mission 
studies is a throttleable cryogenic 
hydrogen- oxygen expander-cycle rocket 
engine that is designed for high per- 
formance (high specific impulse and 
long life), reusability, human-rating, 
and space-basing. The thrust level is 
designated to be approximately 90 to 
111 kilo-Newton (20,000 to 25,000 
pounds) thrust, and have a throttling 
range of approximately 10:1 for lunar 
descent maneuvering. 

With the exception of the maximum 
thrust rating, these characteristics 
are identical to the requirements of 
the Orbit Transfer Vehicle Engines for 
which both Aerojet and Rocketdyne com- 
pleted preliminary designs (contracts 
NAS3-23772 and NAS3-23773) . Each 
contractor was tasked to use their 
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preliminary design as the reference 
around which to specify the ICHM 
system. The engine descriptions are 
included with each of the ICHM assess- 
ment reports (ref's 1 & 2) . The 
Aerojet design is a 34 kN (7500 lb) 
thrust dual-expander engine, and the 
Rocketdyne design is a 34 kN (7500 lb) 
thrust full-expander engine. 

Rocketdyne states in their report that 
all conclusions based on the 34 kN 
(7500 lb) engine would be equally valid 
for a 90 kN (20,000 lb) engine. 

Minimum Required ICHM Functions 

Based on the mission requirements, 
both contractors derive similar lists 
of minimum ICHM functions and features. 
To avoid confusion from the different 
terms and arrangements of each contrac- 
tor's list, the lists are synthesized 
into the single list presented below. 
The four major functional areas are: 
engine control, safety monitoring, 
diagnostic monitoring, and condition 
assessment. This synthesis contains 
all the pertinent items from either 
contractor, and in those cases where 
only one contractor proposed a func- 
tion, that difference is mentioned. 
Where applicable, references are cited 
for functions that are discussed more 
thoroughly in other references. 

Engine Control 

Normal engine operation spans sev- 
eral phases that are summarized below. 

A complete list of phases and the asso- 
ciated status of the control and moni- 
toring functions is detailed in the 
Aerojet report (ref. 1). 

A. Prestart Checks 

B. Start Sequence 

1. Chill-down 

2. Tank Head Ignition 

3. Tank Head Idle 

4. Pumped Idle 

C. Main Stage 

1. Proportional Throttling 

Control (closed loop on 

chamber pressure) 

2. Proportional Mixture Ratio 

Control (closed loop on flow) 

D. Normal Shutdown 


1. Throttle Down 

2. Post-firing Safing 

E. Dormancy 

F. Engine Replacement 

Prestart Checks The prestart checks 
involve powering up the ICHM system and 
performing built-in tests plus some 
degree of assessing the condition of 
the engine using data from the previous 
firing and using the sensor outputs 
during the engine's start sequence. 

Although both contractors include 
prestart checks as one of their ICHM 
functions, a more in-depth study was 
conducted under NASA contract (ref. 4) 
in parallel with these assessments to 
identify and compare various methods 
for performing automated prestart 
readiness checks. These methods span a 
range from actual test-firing to an 
entirely static checkout (no physical 
cycling of any components) . The tech- 
nology readiness and remaining develop- 
ment cost of these methods is outlined 
in this study. (At the time of writing 
this paper, no conclusions were yet 
available . ) 

Start Sequence The tank head start 
sequence involves phases to satisfy the 
requirement of a zero-gravity engine 
start. The duration of this sequence 
varies, but it can take several sec- 
onds. Note that a chill -down phase is 
required which is accomplished by vent- 
ing cryogenic propellants through the 
engine prior to ignition. 

Main Stage To provide mission 
profile and propellant utilization 
flexibility, both the thrust and mix- 
ture ratio are continuously variable, 
rather than having discrete design- 
point settings. This is accomplished 
by using multi-variable closed-loop 
control of thrust and mixture ratio 
based on the feedback from combustion 
pressure and propellant flow, respec- 
tively. Other parameters such as valve 
positions or temperatures may also be 
required in the feedback loops. Depen- 
ding on engine design, other parameters 
may also be subject to closed loop con- 
trol, such as the control of the oxygen 
turbine inlet temperature in the case 
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of the Aerojet dual - expander engine. 

Shutdown The time to go from full 
thrust to zero thrust may be as long as 
two to three seconds because of the 
large residual propellant volumes down- 
stream of the main shutoff valves (ref. 
1) . After the engine is at zero 
thrust, the engine is vacuum purged and 
the actuators are set to safe positions 
for dormancy. 

Dormancy Assuming that the engines 
will be space-based and reusable, 
another phase of engine operation is 
the dormancy period when the engine is 
not used. Both contractors specify 
that heaters are required to prevent 
degradation of the electronics during 
this period. No other specifics are 
addressed concerning possible engine 
degradations from long term exposure to 
the hazards of the space environment. 

Space hazards were inventoried 
under a separate grant to the Univer- 
sity of Cincinnati (ref. 5). This 
study identifies the types and relative 
magnitudes of space hazards in the low- 
Earth-orbit (LEO) to lunar space 
regimes. The specific effects that 
these hazards would have on rocket 
engines have not yet been determined. 

Engine Replacement Another opera- 
tional phase, assuming the engine is 
space-based, is the replacement of an 
engine in a vehicle and the associated 
checks to insure the integrity of this 
installation. Neither contractor 
details the impacts of this phase other 
than through the regular prestart 
checks . 

Safety Monitoring 

For the safety of the crew and 
vehicle, critical parameters of the 
engine's operation are monitored. If 
these parameters exceed preset red-line 
values, the engine will be immediately 
shutdown to prevent catastrophic fail- 
ure. Both contractors specify using 
this red- line/shutdown method for 
safety monitoring. In addition, both 
contractors specify the use of sensor 
validation and fault accommodation as a 
minimum feature. Sensor validation/ 


fault accommodation refers to methods 
that check sensors for erroneous 
outputs, and if detected, remove that 
sensor's output from the control logic. 
Either redundant sensor data or analyt- 
ical redundancy replaces that sensor's 
output . 

An additional feature to the above 
described red-line method is the capac- 
ity for condition-dependent red-lines. 
Condition- dependent red-lines are 
values that change depending on the 
operational phase of the engine. Since 
only one contractor, Aerojet, specifies 
having this feature, this feature is 
considered only a candidate minimum 
requirement. Aerojet proposes to 
provide this feature by separating the 
control and monitoring computers in the 
control architecture. The monitoring 
computer sets the red- line values 
depending on engine conditions, and the 
control computer uses the red- line 
values in the usual manner. 

Another aspect of safety monitoring 
is engine -out accommodation. In the 
event of one failed engine, the remain- 
ing engines in the propulsion system 
must either throttle -up or shutdown to 
maintain the vehicle's thrust balance. 
This requires having the capacity to 
initiate a synchronized emergency shut- 
down of a healthy engine and a synch- 
ronized throttle-up of the remaining 
engines . 

Diagnostic Monitoring 

"Diagnostic monitoring" is the real- 
time monitoring of engine performance 
to detect off-nominal performance and 
to possibly adjust the controls to en- 
sure that the engine can complete the 
mission. This implies real-time detec- 
tion and identification of engine fail- 
ures and degradations, and having con- 
trol options to respond to these fail- 
ures and degradations. This degree of 
control sophistication is sometimes 
called "adaptive control." 

This function is only proposed by one 
contractor, Aerojet, and thus it is 
considered only a candidate minimum 
requirement . 
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Condition Assessment 

"Condition assessment" is the term 
used to refer to the process of collec- 
ting and analyzing the engine data 
after a firing to identify degrada- 
tions, identify anomalous performance, 
and to possibly estimate the remaining 
life of the engine. Both contractors 
leave open the option of where this 
function is performed; on the vehicle 
or on ground-based computers . This 
function is sometimes referred to as 
"post- flight" or "post- hot- fire" 
analysis . 

Minimum ICHM System Elements 

With the exception of certain 
sensor technologies and the degree of 
functional sophistication of the soft- 
ware, both contractors propose similar 
lists of ICHM system elements. These 
elements are summarized into the fol- 
lowing categories: architectures, 
electronics, sensors , control effec- 
tors, and software. Rather than 
providing a single synthesized list, 
the proposed elements from both con- 
tractors are summarized here to 
indicate the span of possible methods 
for providing the minimum functions. 

Architectures 

"Architecture" refers to the con- 
figuration and interconnections of the 
ICHM system components. Aerojet and 
Rocketdyne both use modular architec- 
tures with more than one processor, but 
configure the architecture of these 
processors differently. Both contrac- 
tors provide at least dual- redundancy 
for the electronics in their architec- 
tures. Simplified versions of the 
Aerojet and Rocketdyne architectures 
are shown in Figures 1 and 2, respec- 
tively. In both reports architectures 
are provided at the system level, and 
more detailed schematics are provided 
for the engine controller electronics. 

Aerojet patterned their ICHM system 
after their AREC II (Advanced Rocket 
Engine Controller) (ref. 1). This sys- 
tem consists of three backplane buss 
channels which provide dual redundancy 


for all circuitry, and triple redun- 
dancy for the control and monitoring 
processors. Two of the channels are 
identical and each contain a processor 
for the control functions , a processor 
for the monitoring functions, and cir- 
cuits that interface with the other 
channels, the sensors, the effectors, 
the vehicle and telemetry bus, the 
control and instrumentation bus, and 
the optical disk data storage device. 

The third channel contains control and 
monitoring processors, the interchannel 
interface circuits, and circuits that 
interface with some of the sensors. 
Pre-processors are proposed for the 
more advanced sensor systems such as 
the plume spectrometer and leak detec- 
tors, and some signal conditioning 
circuits are resident within the 
bearing def lectometers and shaft 
def lectometers . To accommodate the 
large amount of data collected by this 
system, an optical disk is also 
proposed . 

Rocketdyne uses a dual redundant 
architecture with dual sets of sepa- 
rate, self -checking , processors for the 
input, control, and output functions. 
These processors are linked via dual 
redundant busses. The input processor 
provides signal conditioning, digitiz- 
ing, and sensor validation/accommoda- 
tion to provide valid sensor data to 
the control processor. The control 
processor receives data from the input 
processor, commands from the vehicle, 
and performs control and monitoring 
functions that provide the engine 
actuator commands to the output proces- 
sor. The output processor contains the 
drivers and feedback processing to com- 
mand and verify the status of all the 
engine's control actuators. 

Electronics 

Aerojet specifies using Intel i80960 
based 32 bit RISC processors, MULTI-BUS 
II backplanes, and a MIL-STD-1553 type 
bidirectional digital interfaces. 

Aerojet also provides specific choices 
for the variety of interface circuits. 
Rocketdyne does not specify the exact 
components that would be used, but does 
list candidate components that are 
similar to Aerojet's selections. 
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Sensors : 

Both contractors specify sensors 
for measuring temperature, pressure, 
vibration, flow, actuator position, and 
pump speeds . The number and type of 
sensors for both the Aerojet and 
Rocketdyne systems are listed in Table 
I. With the exception of Aerojet's 
larger number of sensors for the 
actuators and their extra advanced 
sensors, both contractors have roughly 
50 to 60 sensors in each of their 
systems. Aerojet further specifies 
which sensors are duplicated for 
redundancy. Rocketdyne does not 
specify which sensors would be 
duplicated for redundancy because they 
require more definition of the operat- 
ing requirements before they can 
specify redundancies. 

Aerojet also proposes using some 
newer sensors to augment the tradition- 
al sensor set. These included a Fabre- 
Perot interferometric plume spectrom- 
eter, two unspecified sensor systems 
for sensing oxygen and hydrogen leaks, 
capacitance type three-axis shaft 
def lectometers for the turbopumps, and 
capacitance displacement bearing 
deflectometers . Along with each of 
these advanced sensors are associated 
data processing or signal conditioning 
electronics . 

Rocketdyne specifies more advanced 
sensor technology for pressure and 
actuator position measurement. They 
specify silicon-on- sapphire (SOS) pres- 
sure transducers and position resolvers 
over the more mature strain gage pres- 
sure transducers and linear-variable- 
differential - transformers (LVDT) . The 
SOS technology offers higher accuracy, 
wider range, longer-term stability, and 
higher temperature tolerance than the 
conventional alternatives . Rocketdyne 
also proposes using eddy current sen- 
sors instead of limit switches. As 
alternative technologies , Rocketdyne 
lists the more conventional pressure 
transducers, LVDTs , and limit switches 
in their sensor list. 

Control Effectors 

Both contractors specify using 


electro-mechanical actuators (EMA) with 
DC motors for valves, gimballing, and 
nozzle extension/retraction. 

Rocketdyne additionally specifies a 
pneumatic back-up for their EMAs to 
effect a fail-safe engine shut-down in 
the event of an EMA failure. Both 
contractors use spark igniters, and 
Rocketdyne listed plasma torch igniters 
as an option. 

The type and quantity of control 
effectors is outlined in Table II. 
Aerojet specifies 6 proportional and 6 
on/off valves, while Rocketdyne speci- 
fies 3 proportional and 5 on/off 
valves. The reason behind the greater 
number of valves in the Aerojet system 
is partly due to their choice of the 
dual -expander engine cycle. 

Aerojet also proposes an additional 
gimbal actuator for engine -out 
compensation. 

Software 

The categorization of the software 
elements parallels the synthesized 1CHM 
functions presented earlier. An abbre- 
viated list of software elements is 
provided below: 

Engine Control: 

A. Prestart Checks 

B. Start Sequence 

C. Main Stage 

1. Proportional Throttling 

Control 

2. Proportional Mixture Ratio 

Control 

D. Normal Shutdown 

1. Throttle Down 

2. Post-firing Safing 

E. Dormancy 

F. Engine Replacement Integrity 

Check 

Safety Monitoring 

A. Red- line/shutdown Monitoring 

B. Condition- dependant Red-lines 

C. Sensor Validation/Fault 

Accommodation 

Diagnostic Monitoring 

A. Performance Failure 

Identification/Accommodation 

B. Component Failure 

Identification/Accommodation 
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Condition Assessment 

A. Data Management 

B. Engine System 

Failure/Degradation Identification 

C. Component Failure/Degradation 

Identification 

Of these functions, each contractor 
lists the sensor inputs and commands 
that are required to perform each func- 
tion. Three examples; throttling con- 
trol, mixture ratio control, and red- 
line monitoring, are summarized next. 

During main stage, Aerojet controls 
2 valves for throttling using the feed- 
back from 3 sensors: combustion pres- 
sure and 2 valve positions. Rocketdyne 
controls one primary valve for throt- 
tling using feedback from 2 sensors: 
combustion pressure and valve position. 
In both systems, other valves are also 
adjusted to balance the cycle during 
thrust and mixture ratio changes. 

For main stage mixture ratio con- 
trol, Aerojet controls 2 valves using 
the feedback from 8 sensors: 2 flows, 2 
temperatures, 2 pressures, and 2 valve 
positions. Rocketdyne controls one 
primary valve using feedback from 4 
sensors: 2 flows and 2 valve positions. 

For red- line monitoring, Aerojet 
monitors 11 items based on the inputs 
from 51 sensors, and Rocketdyne direct- 
ly monitors 8 red-line sensors. 

Because a complete engine design is 
a prerequisite for further software 
descriptions, neither contractor de- 
tails the software or algorithms that 
would be used to answer each function. 
Aerojet does, however, specify using a 
UNIX based derivative for the operating 
system, with Ada code. Expert systems 
written in Ada code are listed for the 
diagnostic executive, the preflight 
readiness, the sensor failure identifi- 
cation, the performance failure ident- 
ification, and the component failure 
identification programs. Rocketdyne 
states that much of the software could 
be based on the existing SSME software, 
the SSME Block-II controller software, 
and the RS-44 engine software. 


Because of Aerojet's condition- 
dependent red- lines, real-time diagnos- 
tics, the possibility for adaptive con- 
trol, and the extra sensors, the magni- 
tude of the Aerojet software is larger 
than the Rocketdyne software. 

Discussion of Differences 
in Contractor Minimums 

Based on the mission requirements, 
both contractors derive similar lists 
of minimum ICHM functions and features, 
but each propose different approaches 
to provide these functions. Some of 
these differences span a range of capa- 
bilities or technical maturity. This 
indicates that there is a reasonable 
certainty about what ICHM functions are 
required, but there are a variety of 
ways to provide these functions. 

The most noticeable differences in 
capabilities are the use of condition- 
dependent redlines, the possibility for 
adaptive control, and the inclusion of 
advanced sensors, which are all exclu- 
sive to the Aerojet system. Aerojet 
states in their report that these fea- 
tures and sensors are included as mini- 
mum features to address the substantial 
reliability requirement associated with 
reusability and zero maintenance, and 
to provide the necessary flexibility to 
accommodate mission variations and 
product improvements . 

To leave open the option of includ- 
ing these extra features, the synthe- 
sized list of minimum functions and 
features presented earlier includes the 
extra features of the Aerojet system. 

As more definition of the missions, 
vehicles, and engines become available, 
the exact characteristics of the ICHM 
system can be refined to reflect those 
specif ications . 

Technology Readiness Estimates 

Both the proposed systems require 
more advanced technologies than those 
used in the existing Space Shuttle Main 
Engine (SSME) or the RL-10. Both study 
contractors use more than one proces- 
sing unit in their architecture; use 
multi-variable, closed-loop control for 
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continuously variable thrust and mix- 
ture ratio; use sensor validation and 
fault accommodation to address the 
potential problem of a failed sensor; 
use EMAs for valves and gimballing; and 
use some of the newer software tech- 
niques, such as expert systems, for 
some of the fault and degradation 
detection functions. 

To provide a more accurate 
assessment of the level of technical 
maturity for these minimum ICHM tech- 
nologies, the contractors assessed the 
technology readiness of all their sys- 
tem components using the same rating 
scale that is used by the NASA Office 
of Exploration (described in ref. 3). 
This scale provides a consistent base- 
line for comparing the maturity of 
various technologies . 

The contractors' assessments have 
been summarized into the following 
categories: system configuration, sen- 
sors, control effectors, electronics, 
and software. Their results have been 
synthesized to remove the ambiguities 
caused by the different interpretations 
of the readiness scale. A short state- 
ment about the next steps to advance 
each category of technology to the next 
readiness level has also been added. 

In general, both Aerojet's and 
Rocketdyne's estimates of the tech- 
nology readiness are about equal. 

Their assessments conclude that all the 
required technologies have already been 
demonstrated in the lab or in similar 
applications, with the exception of the 
advanced software and system integra- 
tion which have reached the level of 
proof of concept. The magnitude of the 
remaining work is reflected by the cost 
estimates discussed in the next 
section. 

System Configuration 

System integration technology has 
reached at least the level of concept- 
ual design and perhaps as high as 
having been demonstrated in the lab, 
depending on interpretation of the 
terms used in the rating scale. The 
systems described in the Aerojet and 
Rocketdyne reports constitute concept- 


ual designs. A software simulation of 
either of these systems that takes into 
account a dynamic engine model and 
characteristics of the sensors, 
effectors, and interconnecting elec- 
tronics would constitute a proof-of- 
concept demonstration. An on-engine 
test of a breadboard ICHM system, 
including actual sensors and effectors 
would constitute having demonstrated a 
system in a relevant environment. 

Sensors 

Many of the required sensors are 
already used in space flight systems, 
and most of the advanced sensors have 
reached at least the level of a labora- 
tory demonstration. Some of the more 
advanced sensors have also been tested 
in relevant environments. Further 
sensor advancement typically requires 
the application of laboratory-proven 
sensors into relevant environments such 
as rocket engine component test stands. 

Control Effectors 

EMAs have been demonstrated in the 
lab and in other aerospace applica- 
tions. The valves for this class of 
10 : 1 throttleable , hydrogen- oxygen 
engines have at least been conceptually 
designed. Some of the simpler valves 
are more mature, being based directly 
on valves used in similar applications. 
Further EMA advancement for space 
engines may only require the applica- 
tion of EMA technology to a 
representative testbed engine. 

Electronics 

All the specified electronics are 
used in other applications, and thus 
are considered to be at the level of a 
lab demonstration or higher. Further 
advancement of the electronics only 
requires the application of this tech- 
nology to a representative testbed 
engine . 

Software 

Software technology has either been 
conceptually designed or reached the 
level of proof of concept, depending on 
the specific function. Software tech- 
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nology is less advanced than the other 
technologies mainly because further 
software development requires a specif- 
ic engine design and ICHM system con- 
figuration as a prerequisite. For 
example, complete engine models are 
required to design control methods such 
as gains and valve schedules and to 
guide failure modeling. Specific 
engine failure mode and effects analy- 
sis (FMEA) and test data would also be 
useful in refining failure and degrada- 
tion detection software. Both contrac- 
tors state that specific engine designs 
were necessary prerequisites to advanc- 
ing ICHM software. 

Cost Estimates 
Total System Cost 

The cost to provide a complete ICHM 
system ready for testing on an engine 
system testbed is estimated to be 
between $30 and $45 million. This 
requires a six year technology develop- 
ment period. The cost estimate 
includes all sensors and effectors 
which are normally considered as part 
of the engine cost. This estimate does 
not include the cost of testing the 
ICHM system on a testbed engine, but 
Rocketdyne specifies that a represen- 
tative test series would include 17 
tests of 300 seconds duration each. 

To estimate the cost to add an ICHM 
system to a given engine it would be 
necessary to subtract the cost of all 
sensors, valves, actuators, and elec- 
tronics that already exist on the 
engine . Depending on the engine 
choice, this could substantially reduce 
the cost of the ICHM system. 

Another important aspect of the 
cost of an ICHM system is the potential 
savings from having an ICHM system 
during the technology development 
program. Since the ICHM system is 
designed to prevent catastrophic fail- 
ures, the ICHM system can repeatedly 
save the cost of replacement engines 
and facility repairs. The ICHM system 
is also designed to reduce or eliminate 
inspections and could be used to mini- 
mize unnecessary maintenance inspec- 


tions, further reducing the cost of the 
engine technology development program. 

Range and Uncertainty 
of Cost Estimates 

The span of $30 to $45 million in 
the estimates reflects both the differ- 
ences in the individual contractor 
estimates, and the level of uncertainty 
within each estimate. Both Aerojet and 
Rocketdyne state a possible error band 
of +/- 15% (approx. +/- $6M) exists 
within their estimates. 

The differences between the indi- 
vidual estimates are due to the addi- 
tional costs of Aerojet's more advanced 
sensors and software, and Rocketdyne 's 
larger estimate for electronics. Aside 
from these differences, the cost esti- 
mates from both contracts are approx- 
imately equal and thus reflect a 
reasonably representative estimate. 

The estimate for the cost of 
comparable electronics is significantly 
different between the two contractors. 
Aerojet estimates about $8M for their 
electronics (not including the advanced 
sensor electronics) , and Rocketdyne 
estimates about $26M for electronics. 
This is a considerable difference. 
Aerojet has a more detailed listing of 
the electronic components , and the 
Rocketdyne estimate is based on exper- 
iences with the Block II SSME control- 
ler. Other than this distinction, 
there is not enough information in the 
reports to objectively determine the 
reasons behind this difference. 

Itemized Costs 

The cost estimates are broken down 
into the following four categories: 
sensors, control effectors, electron- 
ics, and software. By filtering the 
contractor results into these categor- 
ies, separating out costs for Aerojet's 
more advanced features, and separating 
out the major cost difference on elec- 
tronics, a synthesized break down of 
costs becomes: sensors, $1M; control 
effectors, $13M; electronics, $8M; and 
software, $6M. Adding advanced sensors 
would add about $4M, and adding more 
sophisticated software would add about 
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another $4M. 

The advanced sensor estimate is 
derived by isolating the costs of the 
sensors and electronics associated with 
Aerojet's advanced sensors. The 
advanced software estimate is derived 
by subtracting Rocketdyne's estimate 
for the more basic software from 
Aerojet's estimate for a more advanced 
software package. 

The difference in system cost from 
adding more advanced sensors and soft- 
ware is relatively insignificant com- 
pared to the span of the total cost 
estimate ($8M versus $15M) , indicating 
that cost may not be the major driver 
to selecting the required degree of 
capability for a complete ICHM system. 

The distribution of costs for the 
synthesized estimate, the Aerojet 
estimate, and the Rocketdyne estimate 
are shown in the pie charts of Figures 
3, 4, and 5, respectively. 

Other Findings 
High Speed Turbopumps 

The most critical components for 
condition monitoring are the high-speed 
turbopumps (speeds greater than 70,000 
rpm) . The sensors and algorithms 
associated with monitoring high speed 
bearings, seals, and shaft dynamics are 
critical elements of an ICHM system for 
this class of engine. Rocketdyne 
addresses this subject by suggesting 
the use of newer software techniques, 
and Aerojet addresses this subject by 
suggesting the use of three-axis shaft 
def lectometers , bearing def lectometers , 
and advanced software. 

Vehicle Interface Assumptions 

Since the engine's ICHM system is a 
subset of the entire vehicle's control 
and monitoring system, one aspect of 
the ICHM system is the vehicle inter- 
face. Both Aerojet and Rocketdyne use 
virtually identical assumptions for the 
vehicle interface. These assumptions 
are listed next. 


Vehicle Propellant System For 
compatibility with this class of 
engines, the propellant tanks are 
assumed to have the following 
characteristics : 

(1) Pressure regulation is provided 
by the vehicle. 

(2) The vehicle supplies the inlet 
propellent valves. 

(3) Propellant tanks are pressurized 
using autogenous gas supplied from 
the engine. 

Vehicle Electrical Power Twenty- 
eight volt direct current electrical 
power was assumed to be provided by the 
vehicle and have the following 
characteristics : 

(1) During periods where the engines 
are not being used, continuous power 
will be required for heaters to 
prevent deterioration of the 
electronics . 

(2) Immediately prior to, during, 
after engine operation, modest power 
will be required to drive the ICHM 
electronics. The ICHM system shall 
have its own power regulators. 

(3) Immediately prior to, during, 
and immediately after engine opera- 
tion, intermittent power will be 
required to drive all engine EMAs 
and other control effectors. 

Vehicle ICHM Communication 
Communication between the vehicle and 
the ICHM system will be via a triple 
redundant connection to a bidirectional 
digital bus, such as MIL STD 1553B. 

The ICHM system will provide engine 
status to the vehicle and all data 
through the vehicle for telemetry. It 
is assumed that the vehicle system 
provides the following commands: 

(1) Start-up and shutdown commands 

(2) Thrust level 

(3) Mixture ratio 

(4) Gimbal angle 

(5) Nozzle position 

Summary of Conclusions 

Based on the results of the Aerojet 
and Rocketdyne assessments, it appears 
to be feasible to provide the tech- 
nology to meet the ICHM needs of 
projected SEI missions. The mission 
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requirements are assumed to include: 
human-rating, space-basing, five- 
mission reusability without major 
service, and lunar descent throttling 
control. It is estimated that such an 
ICHM system could be ready for testing 
on an engine system testbed within six 
years and for a cost between $30 and 
$45 million. 

The cost estimate includes many 
components which are normally consid- 
ered part of the engine cost (sensors, 
valves, and actuators), and thus the 
actual added cost of the ICHM system 
may be less than $30-45 million. The 
cost differences of adding the more 
advanced features or sensors is 
relatively insignificant compared to 
the span of the cost estimates. 

Another aspect of the ICHM system 
costs is the potential savings from 
having an ICHM system. Every time the 
ICHM system prevents the catastrophic 
failure of the testbed engine it saves 
the cost of a replacement engine plus 
the cost of repairing the test 
facility. Further savings could be 
realized by using the ICHM's condition 
assessment function to minimize 
unnecessary maintenance inspections. 

The minimum required functions 
include: nominal engine control encom- 
passing preflight checks, a start 
sequence that includes chill -down and 
tank-head start, main stage with pro- 
portional thrust and mixture ratio 
control; safety monitoring using 
condition- dependent red- line/shutdown 
methods, plus sensor validation/fault 
accommodation; real-time diagnostic 
monitoring with the option for adaptive 
control; and post-firing condition 
assessment to detect component degra- 
dations. Of these functions, the 
condition-dependent feature for red- 
lines and real-time diagnostics with 
the option for adaptive control are 
candidate features . 

To provide these functions, tech- 
nology that is more advanced than that 
used in existing flight-proven rocket 
engines is required. These include: 
modular architectures with multiple 32 
bit processors, closed-loop multi- 


variable proportional control for at 
least the thrust and mixture ratio, 
sensor validation/fault accommodation, 
and the use of EMAs . 

In addition, the following sensor 
technologies may be minimally required: 
silicon-on-sapphire pressure and 
position sensors, a plume spectrometer, 
bearing deflectometers , turbopump shaft 
def lectometers , and distributed hydro- 
gen and oxygen leak detection systems. 

With respect to mission and vehicle 
planners, the noteworthy items include: 
The engine's chill -down phase involves 
propellant dumping; a tank head start 
was assumed for the engine which 
requires a few seconds to reach full 
thrust; the shutdown may take 2 to 3 
seconds to reach zero thrust; electri- 
cal power is required from the vehicle 
to run EMAs during engine firing and to 
run heaters in the electronics during 
dormant periods; propellant tanks are 
assumed to be autogenously pressurized 
by gas from the engine; and a MIL- STD 
1553B or similar bus will be used for 
communication between the engines' and 
the vehicle's control and monitoring 
systems . 

Virtually all of the technologies 
required to provide the minimum ICHM 
system have reached at least the level 
of a laboratory demonstration and some 
are in use today in other systems. The 
least mature of the technologies are 
the advanced sensors, the software, and 
system integration. Further sensor 
advancement typically requires the 
application of the sensors into a 
relevant environment. Further software 
advancements require specific engine 
designs as a prerequisite. System 
integration would be satisfied by 
building an ICHM system and testing it 
on an engine system testbed. 

Topics that still remain to be fully 
addressed include preflight assessment 
methods, automated methods to verify 
the integrity of an in- space engine 
installation, and methods to monitor or 
compensate for long term exposure to 
space hazards. 
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TABLE I. 

SENSOR TYPES AND QUANTITIES 


MEASURAND 

AEROJET 

ROCKETDYNE 

QUANTITY 

TYPE 

QUANTITY 

TYPE 

cryogenic temperature 

A 

platinum RTD 

16 

RTD 

other temperature 

17 

K- thermocouple 

0 

— 

pressure 

15 

strain-gage 

15 

silicon on 
sapphire 

vibration 

2 

piezoelectric 

A 

piezoelectric 

flow 

2 

vortex sheding 

2 

turbine 

actuator position 

16 

limit switch 

6 

eddy current 

actuator displacement 

10 

LVDT 

3 

SOS resolver 

effector current 

5 

inductive 

A 

not specified 

pump shaft speed 

5 

capacitive 

A 

variable 

reluctance 

pump shaft deflection 

9 

capacitive 

0 

— 

bearing def lectometer 

A 

capacitive 

0 

— 

plume spectrometers 

1 

interferometer 

0 

— 

leak detection system 

2 

not specified 

0 

— 

TOTAL # OF SENSORS 

92 

(118 with 
redundancy) 
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TABLE II. 
CONTROL EFFECTORS 


CONTROL ELEMENT 

AEROJET 

ROCKETDYNE 

QUANTITY 

TYPE 

QUANTITY 

TYPE 

proportional valves 

6 

EMA pintle 

3 

EMA sector 
ball 

on/off valves 

2 

EMA ball valve 

2 

EMA venturi 
ball 

on/off valves 

A 

solenoid poppet 

3 

solenoid 

poppet 

gimbals 

A 

EMA linear 
actuator 

2 

EMA linear 
actuator 

nozzle extend/retract 

1 

EMA ball screw 

1 

EMA 

igniters 

1 

spark lighter 

2 

spark igniter 

TOTAL # OF EFFECTORS 

18 
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Figure 1. - Aerojet ICHM System Architecture 

* These elements include pre-processing, sginal conditioning, or feedback circuits. 
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Figure 2. - Rocketdyne ICHM System Architecture 
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Figure 3. - Synthesized Cost Estimate 
(Totals $28M base + $8M for adv. elements) 



Figure 4. - Aerojet Cost Estimate 
(Totals $33. 8M) 



Figure 5. - Rocketdyne Cost Estimate 
(Totals $46. 3M) 
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